Re: Track a specific users share access activity?

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 08/14/04 

Date: Sat, 14 Aug 2004 11:43:03 -0500

Assuming you have already enabled auditing of object access then you can enable
auditing of your folders. You can add users and groups just like you can for ntfs
permissions. Avoid using everyone and users to audit. If you want to audit delete for
a specific group of users create a global group for those users and audit that group
for just deletions and nothing else. Be sure to substatiantially increase the size of
the security log. Deletions may not be immediately obvious but if you view Event ID's
as "pairs" for 560 and 562 by timestamp, you should be able to figure out who deleted
what files. The link below has additional info on auditing. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

"Doug Lowenthal" <Doug@BuildingITC.com> wrote in message
news:BD43ABEF.CC4A%Doug@BuildingITC.com...
> Is there a way to audit a specific users activity instead of turning on
> general object auditing and seeing every ones file access. We have many
> shares on the server and would like to track specific users access to those
> documents. I do not care to see/be notified (using Event Sentry) when
> someone I am not concerned with opens the file/folder. Any help would be
> appreciated.
>

Relevant Pages

  • HELP - File Auditing
    ... not automatically trigger any new "object access" audit ... individual objects for audit events to be logged. ... To enable auditing on a file/directory do the following: ... GPEDIT.msc in that server, ...
    (microsoft.public.win2000.security)
  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • Re: auditing
    ... Enable auditing of account management will log the creation and changes to ... You can audit Directory Service access to audit OU's. ... This security setting determines whether to audit each event of account ... For specific instructions about how to configure auditing policy settings, ...
    (microsoft.public.win2000.active_directory)
  • Re: Autoexec.nt file missing?
    ... you can't enable Auditing on a computer running Home Edition. ... You must specify what to audit. ... > example, a file, folder, registry key, printer, and so forth-that has its ...
    (microsoft.public.windowsxp.newusers)
  • RE: Auditing Features
    ... >Subject: Auditing Features ... >descriptions on auditing Object Access and what it really ... The Audit object access setting determines whether to audit the event of a ... Failure audits generate an audit entry when a user unsuccessfully attempts ...
    (microsoft.public.win2000.security)